debug

/factory:debug — All-Hands Sweep + Reviewer ⇄ Implementer Loop

## Iron Law

EVERY REVIEW (PHASE 0 SWEEP AND EVERY LOOP ROUND) COMMITS A REVIEW ARTIFACT TO STATE BEFORE SPAWNING THE EXECUTOR.

• Phase 0 (sweep): Each reviewer (subagent or Codex) writes its raw output to phase0/<reviewer>.raw.txt. The orchestrator consolidates them into phase0/findings.json and phase0/plan.md BEFORE spawning the Phase 0 executor.
• Phase 1 (loop): The active reviewer path (Codex via pipeline-debug-review, or Claude via quality-reviewer agent + pipeline-debug-normalize) writes round-N.review.json to the run's state dir and prints {blocking_count, below_threshold_count, verdict, review_file} on stdout. You do NOT spawn the executor without first persisting that artifact, and you do NOT advance to round N+1 without the executor's STATUS line recorded.

Violating the letter of this rule violates the spirit. No exceptions.

Iron Laws

1. Resolve the base ref before the first review. --base <hash> overrides; --full resolves to the empty-tree SHA 4b825dc642cb6eb9a060e54bf8d69288fbee4904; default is HEAD~1. --base and --full are mutually exclusive — abort with a usage line if both are present.
2. Validate --fixSeverity upfront. Allowed: critical | high | medium | all. Default medium. Reject anything else.
3. Time limit is a soft boundary. Check the deadline at the TOP of Phase 0 (step 6) and at the TOP of each Phase 1 loop iteration only. Do NOT abort a reviewer or executor in flight.
4. Surface every escalation. When pipeline-debug-escalate prints ESCALATED path=<X>, your final user-facing message MUST include the line Escalated to human review. Audit trail: <X>.
5. Phase 0 fan-out is parallel — single message, multiple Agent tool calls. Architecture, security, quality, and implementation reviewers MUST be dispatched in one assistant message so they run concurrently. The Codex sweep (when available) is launched in the same message via Bash with run_in_background: true. The orchestrator's own line-by-line review runs immediately after the parallel batch returns (it cannot truly parallelize with itself).
6. Findings are validated before they are addressed. Every Phase 0 finding is classified confirmed | dismissed | uncertain against (a) the actual code in the diff and (b) the apparent intent of the diff (since /factory:debug has no spec). Only confirmed findings enter the plan. Dismissed and uncertain ones are catalogued with the reason.
7. Budget is gated twice — but pauses, never stops the factory. The 5h API budget is consulted via pipeline-quota-check (a) before launch and (b) between Phase 0 and Phase 1. The full ladder is in the Quota-aware ladder section below. Crossing a low-budget threshold delegates the wait loop to pipeline-quota-gate-cli, which paces a bounded wait-and-retry (quota_wait_cycles cap 60 ≈ 9h, quota_stale_cycles cap 6 ≈ 1h) until the next band is reached — it does not abort. The only abort paths are: the wait-cycle cap (stuck high-utilization) and the stale-cycle cap (telemetry fully broken). --quick skips Phase 0 and skips the between-phases re-check. Both budget gates run only after the Autonomy precondition (above) clears — quota telemetry is only fresh inside an autonomous session.

Inputs

The command parses flags into a single line of arguments and invokes this skill with them. Expected variables:

• BASE — resolved base ref (hash, branch, or empty-tree SHA)
• SEVERITY — critical | high | medium | all
• LIMIT — integer seconds (0 = unlimited)
• QUICK — true | false (default false). When true, skip Phase 0 entirely.
• RUN_ID — generated by the skill if not provided (debug-<unix-ts>)

Quota-aware ladder

The skill consults pipeline-quota-check (5h window) before launch and again between Phase 0 and Phase 1. The 5h remaining percentage drives the response (remaining = 100 - five_hour.utilization):

Remaining	Pre-launch behavior	Between Phase 0 → Phase 1
≥ 60%	Free run (silent)	Free run (silent)
40–60%	Free run; print one-line budget notice (NOT a prompt)	Free run; one-line budget notice (NOT a prompt)
20–40%	Ask user: "5h budget at % used (% left). Use --quick? (Y/n)"	Print notice; proceed but inform user that another sweep would be unsafe
10–20%	Force --quick (skip Phase 0); print explanation	Wait-and-retry loop until remaining ≥ 20% (next band) or window resets
< 10%	Wait-and-retry loop until remaining ≥ 10% (next band) or window resets	Wait-and-retry loop until remaining ≥ 20%

Hard rule: AskUserQuestion fires at exactly ONE pre-launch band (20 ≤ remaining < 40). Above 40%, never prompt. Between-phases gate never prompts at any band.

Pause, do not abort. Crossing a low-budget threshold pauses the run until the next band is reached — it does not stop the factory. The wait loop is delegated to pipeline-quota-gate-cli so the sleep / cycle-cap / stale-cache logic stays in one place (shared with /factory:run):

phase=phase0   # or phase1 below
while :; do
  pipeline-quota-gate-cli --run-id "$RUN_ID" --tier feature --boundary "${phase}-budget"; rc=$?
  case $rc in
    0) break ;;                                              # remaining crossed the next band — proceed
    2) STATUS="BUDGET_ABORTED — wait cycle limit reached"; break ;;
    3) continue ;;                                           # wait_retry — next loop turn refreshes statusline
  esac
done

The CLI maintains circuit_breaker.quota_wait_cycles (cap 60, ≈9h) and circuit_breaker.quota_stale_cycles (cap 6, ≈1h) in run state — the skill no longer rolls its own counters. Pause time is excluded from LIMIT because the CLI writes circuit_breaker.pause_minutes (mirrored by pipeline-circuit-breaker).

A stale usage-cache.json (statusline silent during a sleep) now yields rc=3 instead of aborting; only the stale-cycle cap escalates to abort. Telemetry that was broken before the first wait still aborts at the very first check via the cap on stale cycles, but transient single misses are absorbed.

The AskUserQuestion tool is used for the 20–40% pre-launch prompt; default to --quick if no answer.

Procedure

Autonomy check (precondition for all numbered steps)

The pre-launch quota gate (step 5) reads usage-cache.json, which is only written by the factory statusline writer (factory statusline) while running under merged-settings.json. In a non-autonomous session the cache is stale by design and every quota call returns unavailable. Verify autonomous mode FIRST — the same engine gate factory run create enforces (src/autonomy/mode.ts).

factory autonomy status --json   # exits 0 when autonomous, 1 when not

The payload is { autonomous, envSet, mergedSettingsPresent, mergedSettingsPath }. Persist state.autonomy = { autonomous, checked_at: $(date +%s) } as part of the initial state object written in step 3 below.

If the command exits 0 (autonomous: true), proceed into the numbered Setup steps.

Otherwise, stop. Print: Autonomous mode required for /factory:debug. Relaunch with exactly: claude --settings <mergedSettingsPath> (or export FACTORY_AUTONOMOUS_MODE=1 for CI), then re-run /factory:debug. Run factory autonomy ensure first if mergedSettingsPresent is false. Do not append --dangerously-skip-permissions — merged-settings.json grants scoped autonomy via permissions.allow plus the deny list and PreToolUse guards; bypassing permissions defeats them. Surface the command verbatim, no extra flags.

Note: the old bash pipeline-ensure-autonomy distinguished a stale-cache state (settings wired but statusline not ticked). factory autonomy status reports presence, not freshness; the richer stale-cache state machine is part of the deferred /factory:debug redesign epic (see CLAUDE.md "Known gaps").

Not surfaced in the user-facing summary (parity with /factory:run); audit only via state.autonomy.*.

Setup

1. Validate flags + resolve base. If --full and --base both set, abort: usage: /factory:debug [--base <hash>|--full] [--limit <s>] [--fixSeverity ...].
2. Compute deadline. deadline = LIMIT > 0 ? $(date +%s) + LIMIT : 0.
3. Initialise state. state_dir="${CLAUDE_PLUGIN_DATA:-$HOME/.claude/factory}/debug/$RUN_ID". mkdir -p "$state_dir/phase0". Write state.json with {base, severity, deadline, started_at, quick:$QUICK, autonomy:{...from precondition...}, phase0:{}, rounds:[]}.
4. Detect reviewer once. Run pipeline-detect-reviewer and capture both .reviewer (codex or claude-code) and .command (an absolute path to the Codex wrapper when reviewer == codex; absent otherwise). Persist reviewer in state.json, and — when present — phase0.codex_review_cmd set to the .command string. The choice is fixed for the run; it controls both the Phase 0 Codex slot and the Phase 1 loop branch. Using detect-reviewer's absolute .command (rather than the bare name pipeline-codex-review) avoids PATH-shadow regressions where a stale wrapper on PATH silently swallows reviews.
5. Pre-launch quota gate. Skip if QUICK == true (the user has already opted out of the heavy phase). Otherwise:
   1. Run pipeline-quota-check and capture the full JSON output as quota_raw. From it, capture .five_hour.utilization, .five_hour.resets_at_epoch, and .detection_method for the ladder logic below; the full quota_raw is persisted in step 5.v as the audit trail.
   2. If detection_method == "unavailable": do NOT auto-degrade and do NOT enter the wait loop. Use AskUserQuestion with question "Quota telemetry unavailable (<reason>). Cannot enforce the budget ladder or wait for budget recovery. Continue with --quick (skip Phase 0 + between-phases gate; reviewer ⇄ implementer loop still runs, bounded by --limit and reviewer rounds) or abort?", options Continue with --quick | Abort. There is no default — wait for the user's choice. If Continue with --quick: set QUICK = true, persist state.quick_forced_by = "user-prompt-no-telemetry" and phase0.pre_launch_action = "user-continue-no-telemetry", jump to step 6. If Abort: print STATUS: BUDGET_ABORTED — quota detection failed (<reason>); user declined to continue without telemetry, persist state.budget_aborted = true and phase0.pre_launch_action = "user-aborted-no-telemetry", break.
   3. Compute remaining = 100 - utilization. Apply the Quota-aware ladder (Pre-launch column). The bands below are mutually exclusive — evaluate in order, take the FIRST match, then stop. NEVER use AskUserQuestion when remaining >= 40; the 40–60% notice is a one-line printf, not a prompt.
      • remaining >= 60: proceed silently. No notice, no prompt. Stop.
      • 40 <= remaining < 60: proceed; print exactly one line: Budget notice: <rem>% 5h remaining; proceeding with full sweep. Do NOT call AskUserQuestion. Stop.
      • 20 <= remaining < 40: call AskUserQuestion with question "5h API budget at <util>% used (<rem>% left). Phase 0 fans out 4+ subagents and may consume 10–25% of remaining budget. Use --quick (skip Phase 0)?", options Yes (skip Phase 0) | No (run full sweep). Default to Yes if the user does not respond. If Yes, set QUICK = true and persist state.quick_forced_by = "user-prompt". Stop.
      • 10 <= remaining < 20: enter the wait-and-retry loop (see "Quota-aware ladder" above) with target_band = 20. On exit (cycle limit reached or telemetry broken): abort with the printed status and break. Otherwise re-evaluate from step 5.iii with the fresh remaining.
      • remaining < 10: enter the wait-and-retry loop with target_band = 10. Same exit behavior; on resume re-evaluate from step 5.iii.
   4. Persist phase0.pre_launch_remaining = $remaining (omit when 5.ii fired — no telemetry to record), phase0.pre_launch_action = proceed|prompt|forced-quick|user-continue-no-telemetry|user-aborted-no-telemetry|waited|aborted, and (when waited) circuit_breaker.pause_minutes and circuit_breaker.quota_wait_cycles in state.json.
   5. Provenance. Persist phase0.pre_launch_check in state.json — the raw quota_raw JSON from 5.i augmented with two fields: checked_at (current epoch, seconds) and cache_age_at_check (seconds; checked_at - quota_raw.captured_at when telemetry is present, null when detection_method == "unavailable"). When 5.ii fired (telemetry unavailable), persist the sentinel JSON verbatim under the same key — its reason field is the audit trail. This is the audit record for the budget decision; it is read by post-run inspection, never by the live pipeline.

Phase 0 — All-Hands Sweep (one shot, parallel fan-out)

If QUICK == true (set by flag, by user prompt at step 5.iii, by forced budget-low, or by user prompt at step 5.ii when telemetry is unavailable), skip the entire Phase 0 block (steps 6–12) and jump to step 13 (between-phases gate). Persist phase0.skipped = true and phase0.skipped_reason = "quick-flag" | "user-prompt" | "budget-low" | "user-continue-no-telemetry" in state.json.

6. Deadline check. If deadline > 0 && $(date +%s) >= deadline: print summary with STATUS: TIME_LIMIT and break (do not enter Phase 1).

7. Parallel fan-out (single assistant message, multiple tool calls). Dispatch all of the following concurrently:

   • Agent subagent_type: "architecture-reviewer" — prompt: review diff $BASE..HEAD for module-boundary, dependency-direction, coupling, and AI architectural anti-patterns. Output the agent's standard structured findings (severity + file:line quotes).
   • Agent subagent_type: "security-reviewer" — prompt: review diff $BASE..HEAD for OWASP Top 10, framework-specific risks, and AI insecure defaults. Output the agent's standard structured findings.
   • Agent subagent_type: "quality-reviewer" — prompt: adversarial code-quality review of diff $BASE..HEAD (logic errors, test quality, AI anti-patterns). Output the agent's standard structured findings.
   • Agent subagent_type: "implementation-reviewer" — prompt: trace the apparent intent of the diff $BASE..HEAD (since /factory:debug has no spec, infer intent from commit messages + code shape) and flag where the implementation diverges from that intent or leaves gaps.
   • Codex sweep, only if reviewer == codex: Bash run_in_background: true, command: $codex_review_cmd --task-id "debug-phase0-$RUN_ID" > "$state_dir/phase0/codex.raw.txt" 2>&1 — substitute the literal value of phase0.codex_review_cmd captured at step 4 (already absolute and already includes --base "$BASE"). Track the shell id; collect output later via BashOutput.

   Each subagent's full final assistant message is captured to $state_dir/phase0/<reviewer>.raw.txt (e.g. architecture.raw.txt).

8. Orchestrator self-review. Immediately after step 7 returns, the orchestrator (you) performs an exhaustive line-by-line read of the diff $BASE..HEAD. Cover: correctness, edge cases, error handling, concurrency, resource lifecycle, public-API contracts, test coverage gaps, and anything the four subagent specialists would not natively catch. Write your findings to $state_dir/phase0/orchestrator.raw.txt in the same severity-tagged format as the subagents.

9. Drain the Codex background job (if launched). Poll the shell id with BashOutput until exit; ensure $state_dir/phase0/codex.raw.txt is complete. If Codex exited non-zero, record phase0.codex_skipped = true in state.json with the reason and continue without Codex findings (do NOT abort the sweep).

10. Validate, dedupe, catalogue. For every finding across all *.raw.txt files:

    • Verify against the code — open the cited file:line and confirm the issue exists in the actual diff.
    • Verify against intent — confirm the finding is in scope for the diff (since there is no spec, intent = commit messages + the change itself; out-of-scope drive-by complaints are dismissed).
    • Classify: confirmed | dismissed | uncertain with a one-line reason.
    • Dedupe across reviewers: collapse findings that point at the same file:line + root cause into a single entry; preserve the list of source reviewers.
    • Write the consolidated catalogue to $state_dir/phase0/findings.json with shape:

      {
        "base": "<sha>",
        "severity_threshold": "<SEVERITY>",
        "findings": [
          {
            "id": "p0-001",
            "file": "...", "line": N,
            "severity": "critical|high|medium|low",
            "title": "...",
            "evidence": "<verbatim code or import edge>",
            "sources": ["architecture-reviewer", "orchestrator", ...],
            "classification": "confirmed|dismissed|uncertain",
            "classification_reason": "..."
          }
        ]
      }
      

11. Build the remediation plan. Filter the catalogue to classification == "confirmed" && severity ∈ threshold_set(SEVERITY). Write $state_dir/phase0/plan.md containing, in dependency order: a numbered list of fixes, each with id, file:line, root-cause statement, and the proposed minimal change. If zero confirmed-and-in-threshold findings remain, write plan.md with the single line NO_FIXES_REQUIRED and jump to step 13 (skip the executor — there is nothing to execute).

12. Execute the plan. Spawn one Agent subagent_type: "task-executor", isolation: "worktree", with the Phase 0 executor prompt template (below). Capture its final assistant message to $state_dir/phase0/executor.log. Extract the STATUS line.

    • If STATUS is BLOCKED — escalate: <reason>: run pipeline-debug-escalate --run-id "$RUN_ID" --reason "<reason>" --base "$BASE" --severity "$SEVERITY" --findings "$state_dir/phase0/findings.json" --executor-msg "$state_dir/phase0/executor.log". Print summary with STATUS: ESCALATED and the audit-trail line. Break (do not enter Phase 1).
    • If STATUS is BLOCKED (other): print summary with STATUS: BLOCKED — phase 0 executor blocked: <as-returned>, break.
    • If STATUS is NEEDS_CONTEXT: fall through to Phase 1. Persist phase0.fell_through = "needs-context" in state.json. Rationale: missing context is exactly what the iterative reviewer ⇄ implementer loop is designed to surface and resolve; halting here would waste the rest of the budget.
    • Else (DONE | DONE_WITH_CONCERNS): proceed to Phase 1.

Phase 1 — Reviewer ⇄ Implementer Loop (existing behavior)

13. Between-phases quota gate. Re-read the 5h budget before starting Phase 1:

    1. If Phase 0 was skipped via QUICK, skip this re-check (we only ran the cheap path) and proceed directly to step 14.
    2. Run pipeline-quota-check and capture the full JSON output as quota_raw (used in step 13.4 below). If detection_method == "unavailable": do NOT auto-degrade and do NOT enter the wait loop. Use AskUserQuestion with question "Quota telemetry unavailable between phases (<reason>). Cannot enforce the between-phases ladder or wait for budget recovery. Continue into Phase 1 without the gate (loop still bounded by --limit and reviewer rounds) or abort?", options Continue into Phase 1 | Abort. There is no default — wait for the user's choice. Phase 0 results remain on disk regardless. If Continue into Phase 1: persist phase1.pre_loop_action = "user-continue-no-telemetry", proceed to step 14. If Abort: print STATUS: BUDGET_ABORTED — quota detection failed (<reason>); user declined to continue without telemetry; will not start Phase 1, persist phase1.pre_loop_action = "user-aborted-no-telemetry", break.
    3. Compute remaining = 100 - utilization. Apply the Quota-aware ladder (Between Phase 0 → Phase 1 column). Bands are mutually exclusive — evaluate in order, take the FIRST match, then stop. There is NO AskUserQuestion prompt at this gate at any band.
       • remaining >= 60: proceed silently. Stop.
       • 40 <= remaining < 60: proceed; print exactly one line: Budget notice: <rem>% 5h remaining; entering Phase 1. Stop.
       • 20 <= remaining < 40: print Between-phases notice: <rem>% 5h remaining. Proceeding into Phase 1; another full sweep would be unsafe. Proceed. Stop.
       • remaining < 20: enter the wait-and-retry loop with target_band = 20. On exit (cycle limit reached or telemetry broken): abort with the printed status and break. Otherwise re-evaluate from step 13.iii with the fresh remaining. Phase 0 results remain on disk throughout the wait.
    4. Persist phase1.pre_loop_remaining = $remaining (omit when 13.2 fired — no telemetry to record), phase1.pre_loop_action = proceed|notice|waited|aborted|user-continue-no-telemetry|user-aborted-no-telemetry, and (when waited) circuit_breaker.pause_minutes and circuit_breaker.quota_wait_cycles in state.json.
    5. Provenance. Persist phase1.pre_loop_check in state.json — the raw quota_raw JSON from 13.2 augmented with checked_at (current epoch, seconds) and cache_age_at_check (seconds; checked_at - quota_raw.captured_at when telemetry is present, null when detection_method == "unavailable"). When 13.2 fired (telemetry unavailable), persist the sentinel JSON verbatim. Audit-only — never read by the live pipeline.

14. Loop (round = 1..N):

    1. If deadline > 0 && $(date +%s) >= deadline: print summary with STATUS: TIME_LIMIT, break.
    2. Produce the round review artifact based on reviewer from step 4:
       • Codex branch (reviewer == codex): run pipeline-debug-review --base "$BASE" --severity "$SEVERITY" --out-dir "$state_dir" --round "$round". Parse stdout JSON.
       • Claude branch (reviewer == claude-code): use the Agent tool with subagent_type: "quality-reviewer" to review the diff between $BASE and HEAD. Capture the agent's full final assistant message to $state_dir/round-${round}.raw-review.txt, then run cat "$state_dir/round-${round}.raw-review.txt" | pipeline-parse-review --reviewer claude-code --base "$BASE" | pipeline-debug-normalize --severity "$SEVERITY" --out-dir "$state_dir" --round "$round". Parse the final stdout JSON. If either pipe stage exits non-zero, print summary with STATUS: BLOCKED — review parse failed and break.
    3. If blocking_count == 0: print summary with STATUS: CLEAN, break.
    4. Build the executor-fix prompt. Use the Agent tool with subagent_type: "task-executor", isolation: "worktree". Prompt content (template below).
    5. Capture the executor's final assistant message → state_dir/round-${round}.executor.log. Extract STATUS line.
    6. If STATUS matches BLOCKED — escalate: <reason>: run pipeline-debug-escalate --run-id "$RUN_ID" --reason "<reason>" --base "$BASE" --severity "$SEVERITY" --findings "$review_file" --executor-msg "$state_dir/round-${round}.executor.log". Capture the ESCALATED path=<X> line. Print summary with STATUS: ESCALATED and Escalated to human review. Audit trail: <X>. Break.
    7. If STATUS is BLOCKED (other) or NEEDS_CONTEXT: print summary with STATUS: <as-returned>, break.
    8. Else (DONE | DONE_WITH_CONCERNS): increment round, continue.

15. Final summary (always printed). Include: Phase 0 result (executor STATUS + counts of confirmed/dismissed findings, OR skip reason if phase0.skipped), Phase 1 rounds run, final STATUS, last review's below_threshold_count, the budget ladder actions taken, and the escalation line if applicable.

Phase 0 executor prompt template

[debug:phase0]

You are running under /factory:debug Phase 0 — the all-hands sweep has consolidated findings from architecture-reviewer, security-reviewer, quality-reviewer, implementation-reviewer, the orchestrator's self-review, and (when available) Codex. There is no spec; intent = the diff between ${BASE} and HEAD plus its commit messages.

Inputs:
- Catalogue (validated, deduped): ${state_dir}/phase0/findings.json
- Remediation plan (only confirmed + in-threshold items): ${state_dir}/phase0/plan.md

Iron Law reminder: the orchestrator already verified each finding against the code AND against intent — every item in plan.md is confirmed-and-in-threshold. Implement them in the listed order. Address root causes, not symptoms. If a fix requires a fundamental design/architecture change beyond the diff's intent, end with STATUS: BLOCKED — escalate: <reason>.

Commit fixes locally — do not push.

End with STATUS: DONE | DONE_WITH_CONCERNS | BLOCKED | NEEDS_CONTEXT.

Phase 1 executor-fix prompt template

[debug:round-${round}]

You are running under /factory:debug — there is no spec; the task is to address the reviewer's findings on the diff between ${BASE} and HEAD.

Review file (normalized JSON, contains findings array): ${review_file}

Iron Law reminder: verify each finding (technically + against task intent) before planning a fix; address root causes, not symptoms; if a root cause is a fundamental design/architecture flaw outside scope, end with STATUS: BLOCKED — escalate: <reason>.

For each finding, classify it as confirmed / dismissed / uncertain BEFORE editing any code. Then implement only the confirmed ones. Commit fixes locally — do not push.

End with STATUS: DONE | DONE_WITH_CONCERNS | BLOCKED | NEEDS_CONTEXT.

Final user-facing summary template

/factory:debug summary

- Run ID: ${RUN_ID}
- Base: ${BASE}
- Severity: ${SEVERITY}
- Quick mode: ${QUICK} (forced by: ${QUICK_FORCED_BY|cli-flag|user-prompt|budget-low|user-prompt-no-telemetry|n/a})
- Pre-launch budget: ${PRE_LAUNCH_REMAINING|n/a}% 5h remaining → ${PRE_LAUNCH_ACTION|proceed|prompt|forced-quick|user-continue-no-telemetry|user-aborted-no-telemetry|waited|aborted}
  - Provenance: util=${PRE_LAUNCH_CHECK_UTIL}%, window_hour=${PRE_LAUNCH_CHECK_WINDOW_HOUR}, threshold=${PRE_LAUNCH_CHECK_THRESHOLD}%, cache_age=${PRE_LAUNCH_CHECK_CACHE_AGE}s (from phase0.pre_launch_check; "n/a" when telemetry was unavailable)
  [Waited ${PHASE0_WAIT_MINUTES}m across ${PHASE0_WAIT_CYCLES} cycles — only when PRE_LAUNCH_ACTION=waited]
- Phase 0 sweep: ${PHASE0_STATUS}  [or "skipped (${PHASE0_SKIP_REASON})"]
  - Reviewers run: architecture, security, quality, implementation, orchestrator${CODEX_SUFFIX}
  - Findings: ${CONFIRMED_COUNT} confirmed / ${DISMISSED_COUNT} dismissed / ${UNCERTAIN_COUNT} uncertain
  - Plan: ${state_dir}/phase0/plan.md
- Between-phases budget: ${PRE_LOOP_REMAINING|n/a}% 5h remaining → ${PRE_LOOP_ACTION|proceed|notice|waited|aborted|user-continue-no-telemetry|user-aborted-no-telemetry}
  - Provenance: util=${PRE_LOOP_CHECK_UTIL}%, window_hour=${PRE_LOOP_CHECK_WINDOW_HOUR}, threshold=${PRE_LOOP_CHECK_THRESHOLD}%, cache_age=${PRE_LOOP_CHECK_CACHE_AGE}s (from phase1.pre_loop_check; "n/a" when telemetry was unavailable)
  [Waited ${PHASE1_WAIT_MINUTES}m across ${PHASE1_WAIT_CYCLES} cycles — only when PRE_LOOP_ACTION=waited]
- Phase 1 rounds: ${round}
- Final: ${STATUS}
- Below-threshold findings remaining: ${below_threshold_count}
  [Escalated to human review. Audit trail: <path> — only when STATUS=ESCALATED]

Verification Checklist (MUST pass before printing the final summary)

• Validated flags (mutually exclusive, severity in allowed set, --quick captured)
• Resolved base ref BEFORE the first review
• Detected reviewer once via pipeline-detect-reviewer and used the same branch for both Phase 0 (Codex slot) and every Phase 1 round
• Autonomy check (precondition): Ran factory autonomy status BEFORE the numbered Setup steps; halted with relaunch instructions when it exited non-zero (autonomous: false); persisted state.autonomy.{autonomous, checked_at}.
• Pre-launch quota gate: Ran pipeline-quota-check (unless QUICK was already set by flag); applied the ladder (proceed / prompt / forced-quick / user-continue-no-telemetry / user-aborted-no-telemetry / waited / aborted); on waited, ran the bounded wait-and-retry loop and persisted circuit_breaker.pause_minutes + circuit_breaker.quota_wait_cycles; persisted phase0.pre_launch_* in state.json; persisted phase0.pre_launch_check (raw quota JSON + checked_at + cache_age_at_check) for audit. When detection_method == "unavailable", asked the user via AskUserQuestion whether to continue with --quick or abort (no auto-degrade, no wait).
• Phase 0: Dispatched architecture, security, quality, implementation reviewers in a SINGLE assistant message (parallel). Codex sweep launched in same message via background Bash when reviewer == codex. (Skipped when QUICK == true.)
• Phase 0: Captured raw output from every reviewer (and the orchestrator's self-review) under state_dir/phase0/*.raw.txt
• Phase 0: Wrote phase0/findings.json (validated + deduped + classified) and phase0/plan.md BEFORE spawning the Phase 0 executor
• Phase 0: Captured phase0/executor.log and acted on its STATUS line (escalate / break / fall-through-on-NEEDS_CONTEXT / proceed)
• Between-phases quota gate: Re-ran pipeline-quota-check (skipped only when QUICK == true); applied the between-phases ladder (proceed / notice / waited / aborted / user-continue-no-telemetry / user-aborted-no-telemetry); on waited, ran the bounded wait-and-retry loop and persisted circuit_breaker.pause_minutes + circuit_breaker.quota_wait_cycles; persisted phase1.pre_loop_* in state.json; persisted phase1.pre_loop_check (raw quota JSON + checked_at + cache_age_at_check) for audit. When detection_method == "unavailable", asked the user via AskUserQuestion whether to continue without the gate or abort (no auto-degrade, no wait).
• Phase 1: Persisted each round's review artifact + executor log (and raw-review.txt on the Claude branch) under state_dir
• When any executor escalated, ran pipeline-debug-escalate and surfaced its path verbatim in the summary
• Time limit was checked only at the top of Phase 0 and at the top of each Phase 1 iteration
• Final summary surfaced both budget gate actions (pre-launch + between-phases) and the Phase 0 skip reason if applicable

Can't check every box? Print STATUS: BLOCKED — <reason> instead of a normal summary.